Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

I am trying to test a local website link for a possible XSS attack. Can you please help me looking for a solution in way that if i add some script tag to the end of the URL under test, then it either throw and exception or an alert. For Eg: If link under test is: https://testmysite/login.aspx then what kind of script I can append with URL so that it returns an Exception or an Alert. I hope that the question is clear. Pardon me if this has been already asked as I am unable to find the exact problem.

share|improve this question

3 Answers 3

up vote 3 down vote accepted

In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.

share|improve this answer
    
Thanks. That served the purpose.. :) :) –  khappi Sep 19 '13 at 5:09

Check this out: http://www.acunetix.com/websitesecurity/cross-site-scripting/

Their example is:

<script type="text/javascript">
  alert('This is an XSS Vulnerability')
</script>
share|improve this answer
1  
Isn't that more for including in the body of a page? If you want to attack he URL don't you need ones that take parameters, in which case his example won't be susceptible to it? –  Phil Kirkham Sep 10 '13 at 20:11
1  
I agree. His example doesn't actually lend itself to this vulnerability. But I think his was a made-up example, without an understanding of the issue. Hopefully the link will clear that up. –  Joe Strazzere Sep 11 '13 at 11:09
    
Thanks for the answers guys and link is worth but when i tried to put my site inside the script then the page stays as it is. For eg. if i am on login page then if i try to append the script then page don't display any alert or exception. Is it fine ? How do we get to know that the page has been attacked ? –  khappi Sep 11 '13 at 15:15
2  
Seems you need do a LOT more reading - the example Joe gave is for a site where part of the page is made up from user input e.g. a comment, if there is an exploit then a msg box will appear. Please read the link Joe gave –  Phil Kirkham Sep 11 '13 at 19:09
    
Sure Phil. I'll get back in case of issues. Thanks –  khappi Sep 12 '13 at 4:02

Check this out, I've shared an article on XSS attack and cheat sheet for scripts - http://www.cygnet-infotech.com/is-your-website-safe-against-cross-site-scripting-attacks

share|improve this answer
1  
This is not an answer to the question - it's basically spam for your website. –  Kate Paulk May 30 at 13:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.